CVE-2026-18656 & CVE-2026-18657 - Issue with Kiro IDE and CLI - Executable Resolution from Untrusted Project Directory on Windows
Cli ยท 2026-10-21
Actions
Technical Details
| Affected Versions | 1.0.0 through 1.0.212 (Kiro IDE), prior to v2.10.0 (Kiro CLI) |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-18656, CVE-2026-18657 |
| Migration Required | Yes |
| Cost Impact | Neutral |
What This Means
For DevOps Teams
Update Kiro IDE to version 1.0.228 and Kiro CLI to version 2.10.0 to address security vulnerabilities and prevent arbitrary code execution on Windows systems.
For Platform Teams
Deploy the latest versions of Kiro IDE and CLI to enhance security posture and protect against potential threats from maliciously crafted project directories.
For Executives
Implement immediate upgrades to Kiro IDE and CLI to mitigate security risks associated with CVE-2026-18656 and CVE-2026-18657, ensuring protection against potential code execution attacks.
Source
Related Cli Updates
- CVE-2026-13769 โ Insecure file permissions in AWS CLI (2026-10-19)
- CVE-2026-9255 - Tool Execution Without Authorization via Piped Stdin in Kiro CLI (2026-10-19)
- CVE-2026-9255 - Tool Execution Without Authorization via Piped Stdin in Kiro CLI (2026-10-14)
- CVE-2026-13769 โ Insecure file permissions in AWS CLI (2026-10-14)
- CVE-2026-13769 โ Insecure file permissions in AWS CLI (2026-10-09)